fix: semver version

[TroyKomodo]

Expected Behavior

No CVEs

Current Behavior

Update Semver to patch CVE

pnpm audit
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ semver vulnerable to Regular Expression Denial of      │
│                     │ Service                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ semver                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <7.5.2                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=7.5.2                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ . > @commitlint/cli@17.6.5 > @commitlint/lint@17.6.5 > │
│                     │ @commitlint/is-ignored@17.6.5 > semver@7.5.0           │
│                     │                                                        │
│                     │ . > commitlint@17.6.5 > @commitlint/cli@17.6.5 >       │
│                     │ @commitlint/lint@17.6.5 >                              │
│                     │ @commitlint/is-ignored@17.6.5 > semver@7.5.0           │
│                     │                                                        │
│                     │ . > @commitlint/cli@17.6.5 > @commitlint/lint@17.6.5 > │
│                     │ @commitlint/parse@17.6.5 >                             │
│                     │ conventional-commits-parser@3.2.4 > meow@8.1.2 >       │
│                     │ read-pkg-up@7.0.1 > read-pkg@5.2.0 >                   │
│                     │ normalize-package-data@2.5.0 > semver@5.7.1            │
│                     │                                                        │
│                     │ ... Found 6 paths, run `pnpm why semver` for more      │
│                     │ information                                            │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-c2qf-rxjj-qqgw      │
└─────────────────────┴────────────────────────────────────────────────────────┘
2 vulnerabilities found
Severity: 2 moderate

Affected packages

• cli
• core
• prompt
• config-angular

Possible Solution

N/A

Steps to Reproduce

N/A

Context

N/A

commitlint --version

@commitlint/cli@17.6.5

git --version

2.34.1

node --version

v18.16.0

[escapedcat]

https://github.com/conventional-changelog/commitlint/releases/tag/v17.6.6

[TroyKomodo]

@escapedcat It seems that some packages are still out of date

┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ semver vulnerable to Regular Expression Denial of      │
│                     │ Service                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ semver                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <7.5.2                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=7.5.2                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ . > @commitlint/cli@17.6.6 > @commitlint/lint@17.6.6 > │
│                     │ @commitlint/parse@17.6.5 >                             │
│                     │ conventional-commits-parser@3.2.4 > meow@8.1.2 >       │
│                     │ read-pkg-up@7.0.1 > read-pkg@5.2.0 >                   │
│                     │ normalize-package-data@2.5.0 > semver@5.7.1            │
│                     │                                                        │
│                     │ . > @commitlint/cli@17.6.6 > @commitlint/read@17.5.1 > │
│                     │ git-raw-commits@2.0.11 > meow@8.1.2 >                  │
│                     │ read-pkg-up@7.0.1 > read-pkg@5.2.0 >                   │
│                     │ normalize-package-data@2.5.0 > semver@5.7.1            │
│                     │                                                        │
│                     │ . > commitlint@17.6.6 > @commitlint/cli@17.6.6 >       │
│                     │ @commitlint/lint@17.6.6 > @commitlint/parse@17.6.5 >   │
│                     │ conventional-commits-parser@3.2.4 > meow@8.1.2 >       │
│                     │ read-pkg-up@7.0.1 > read-pkg@5.2.0 >                   │
│                     │ normalize-package-data@2.5.0 > semver@5.7.1            │
│                     │                                                        │
│                     │ ... Found 4 paths, run `pnpm why semver` for more      │
│                     │ information                                            │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-c2qf-rxjj-qqgw      │
└─────────────────────┴────────────────────────────────────────────────────────┘

https://www.npmjs.com/package/conventional-commits-parser
https://www.npmjs.com/package/git-raw-commits

[escapedcat]

Ah thanks, wanna open a PR for these?

[escapedcat]

Just saw these are coming from conventional-changelog not commitlint.
An issue already exists: conventional-changelog/conventional-changelog#1019